Sony Z: How to wipe SSD free space?

Might be opening a can of worms here.

I want to securely erase all trace of deleted files from my SSD.

I tried CCCleaner using Wipe Free Space and File Shredder, using both One Pass and 3 pass.

Looks like it works when you check with Recuva, but when I forensically examine it using MiniTool Power Data Recovery (Digital Media Recovery setting) it finds loads of images which it displays as thumbnails. They aren't all recoverable, but for your interest you can tell what they were.

I've since read warnings not to attempt to wipe the free space and MFT on SSDs, though they might not apply to the Z.

Does anyone have a solution here?

 

Well here's an interesting development. I ran the same scan a day later, with very little subsequent disk activity other than browsing and deleting cache, and whaddyaknow the deleted files are no longer visible.

I presume this is the Garbage Collection in action. This could have all kinds of implications. Now I need to know more.

 

A further follow-up.

Looks like my last post was a bit premature. I'm still able to recover deleted files after doing a free space wipe and leaving the computer idle for 24 hours.

This is a pretty serious privacy downside to the SSD.

 

Are you trying to just wipe free space or the whole drive?

 

This is very interesting. I am going to try this as well.

 

Why don't you just fill up the disk with junk files? That should overwrite the blocks that contain your delete files. It's simple to do. Write a little program that just writes out 0's til your disk is filled.

 

This hasn't anything to do with SSD vs HDD, but how Windows with NTFS works.
There are extra copies on the disk unless you turn off restore options completely, and even then there's the icon cache, which can be scanned for thumbnails of larger deleted images. Then there's the paging file, which also may contain copies of what has earlier been in the memory.
Oh, and the registry probably has multiple references to the files. And programs you opened them with might have their own icon caches and histories.

In short, getting rid of all traces isn't easy unless you planned it from the start. Like running a virtual machine on a partition where restore is turned off, and restoring the VM to a snapshot to get rid of what was on it.

At present, your best bet is to boot the machine from removable media (like a Linux LiveCD), and overwrite the entire Windows partiton (something like dd if=/dev/zero of=sda2 should work, given that the Windows partition is sda2), and then do a Windows restore, followed by a restore from a real backup (not a drive image).

If you don't have a backup, wiping and restoring to factory settings may be the only viable choice.

 

On an ssd, would there be an additional issue related to the wear leveling? (since overwriting a spot on the disk doesn't necessarily overwrite the same physical location)

 

Forensically, yes, but through the standard ATA interface, no. If a block is internally marked as deleted because of wear leveling and hasn't been erased yet, another read of it won't return the old data -- it will point to the reallocated block.
When you access that physical block again, it will be through a different address, and then it has been erased/rewritten.

But forensically, yes, it's possible to dump SSD drives without going through the ATA interface. But in reality, you don't get much extra that way, because modern SSD drives pre-emptively move blocks around and erase sectors to reduce the risk of hitting the horrible worst case random write time of SSDs.

 

What did you find Oscar?

Growler

 

Nothing yet. But when I get back from traveling, I want to play around with this.

 

So here's the deal.

This program (OO Safe Erase 5 Pro) successfully wipes the free space on the z13's SSD.

http://www.oo-software.com/home/en/download/current/oosafeerasepro/index.html

One pass is not enough. High Security (7 Runs) will do the trick, though.

Only program I've found that will do the job so far.

 

Although it's pretty advanced level, and you're unlikely to require proper military-grade erasure, this is well worth a read. Basically it is very very difficult to 100% erase data from a SSD (check out the comments as well for some hardcore discussion re. destroying the physical drive thermite, 500kV overvolting, carbon arc torches etc, and how even this can leave all your data readable if you're not careful!)

You should probably do a cost/benefit analysis as to whether the data of yours that is on the drive is worth more to you than you are selling the drive/computer for.

 

So what you're saying is if I were to sell my laptop, someone might be able to recover my collection of midget ?

 

lol

mokeiko

 

I assume passing a drive through a MRI would completely erase it too right?

 

Lol, there was a word following that was censored by NBR.

 

I still had a good laugh, thanks for that.

mokeiko

 

The MRI would rip all the ferrous metal in the drive to shreds I guess, but the information would probably still be recoverable if you had the time or the inclination to do so. NAND chips don't store things magnetically like hard drives.

 

This is about erasing the "free space," not the entire drive.

 

What do you believe the difference to be?

 

Erasing the whole drive wipes everything. Free space just writes over the empty space to make what's been deleted unrecoverable.